chore: merge dev into main

.codex/rules/default.rules

@@ -130,7 +130,7 @@ prefix_rule(
     pattern = ["rm", ["-rf", "-fr", "-Rf", "-fR"], "/"],
     decision = "forbidden",
     justification = "Recursive delete from the filesystem root",
-    match = ["rm -rf /", "rm -rf /etc"],
+    match = ["rm -rf /", "rm -fr /"],
     not_match = ["rm -rf node_modules", "rm -rf dist"],
 )
 
@@ -153,7 +153,7 @@ prefix_rule(
     pattern = [["dd", "mkfs", "shred", "fdisk", "parted"]],
     decision = "forbidden",
     justification = "Writes to block devices; never needed from a repo",
-    match = ["dd if=/dev/zero of=/dev/sda", "mkfs.ext4 /dev/sdb1"],
+    match = ["dd if=/dev/zero of=/dev/sda", "mkfs -t ext4 /dev/sdb1"],
 )
 
 # ──────────────────────────── databases ──────────────────────────────────────

.github/workflows/ci.yml

@@ -22,4 +22,4 @@ permissions:
 jobs:
   check:
     name: CI
-    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2

.github/workflows/codeql.yml

@@ -24,4 +24,4 @@ jobs:
       packages: read
       actions: read
       contents: read
-    uses: kirchDev/workflows/.github/workflows/_codeql.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_codeql.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2

.github/workflows/fast-forward-queue.yml

@@ -26,7 +26,7 @@ jobs:
       pull-requests: read
       checks: read
       statuses: read
-    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2
     with:
       pr: ${{ inputs.pr }}
     secrets:

.github/workflows/promotion-pr.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   promotion-pr:
     name: Promotion PR
-    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2

.github/workflows/queue-branch.yml

@@ -16,6 +16,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_queue-branch.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2
     secrets:
       BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }}

.github/workflows/release-please.yml

@@ -8,7 +8,6 @@ on:
   push:
     branches:
       - main
-      - dev
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -17,13 +16,12 @@ concurrency:
 jobs:
   release-please:
     name: Release Please
-    # `dev` reaches this workflow for the prerelease job below; release-please
-    # itself only ever runs on the release branch.
+    # Release-please only ever runs on the release branch.
     if: github.ref_name == 'main'
     permissions:
       contents: write
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_release-please.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_release-please.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2
     with:
       # This repo is consumed as `kirchDev/coverage-report@<ref>`, so `@v0` has
       # to keep meaning "the newest v0.x.y".
@@ -41,7 +39,7 @@ jobs:
       # NPM_TOKEN exists in this repo; npm verifies this workflow against the
       # trusted publisher configured on the package.
       id-token: write
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2
     with:
       tag-name: ${{ needs.release-please.outputs.tag-name }}
       # The npm artifact is lib/, built by build:npm — not the action bundle in
@@ -53,17 +51,14 @@ jobs:
     # Skip the version-bump merges release-please pushes onto main.
     if: >-
       ${{
-        github.ref_name == 'dev'
-        || (
-          github.ref_name == 'main'
-          && !startsWith(github.event.head_commit.message, 'chore(main): release')
-          && !startsWith(github.event.head_commit.message, 'chore: release')
-        )
+        github.ref_name == 'main'
+        && !startsWith(github.event.head_commit.message, 'chore(main): release')
+        && !startsWith(github.event.head_commit.message, 'chore: release')
       }}
     permissions:
       contents: read
       id-token: write
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@94cbcbd676b989ac6c6327055a240132f5cd76a5 # v0.8.0
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@1e57db95ff601f03ae87b78e329ef238f9d0cbf6 # v0.8.2
     with:
       prerelease: true
       build-script: build:npm

.tituskirch-skills.json

@@ -48,7 +48,8 @@
     }
   },
   "docs": {
-    "preset": "package"
+    "preset": "package",
+    "render": "duxt"
   },
   "work": {
     "tracker": "github",
@@ -78,7 +79,20 @@
     ]
   },
   "profiles": {
-    "fleet": {
+    "parallel": {
+      "work": {
+        "parallel": true,
+        "concurrency": 4
+      }
+    },
+    "parallel-worktree": {
+      "work": {
+        "concurrency": 8,
+        "branch": "worktree",
+        "parallel": true
+      }
+    },
+    "parallel-worktree-queue": {
       "work": {
         "concurrency": 8,
         "branch": "worktree",